Heh, I've asked a vendor before how often this sort of thing happens to them (just to see how honest they are and maybe to send a message to whoever is listening).After all if a hacker/malware causes downtime less often than the vendor's screw-ups, why use the vendor's product? Safer to look for a vendor with a better track record even if they have more false negatives (especially with rare and/or ancient stuff).

There are overheads and performance impacts to using such stuff, in addition to just the price t

I agree that it raises question as to why one should use them, but "down time" is not the biggest threat out there, if you wanna talk loss/cost. While one's time is valuable, I'm thinking that their bank account information, passwords, etc, might be slightly more valuable to them. Personally, I think good secure end-user practices is the best protection, I do think that a good A/V program is needed.

So, while there is malware out there that is less harmful, more of the malware out there is much MORE harmful... if you disagree, please provide your financial account information, or contact me to transfer all funds to a secured off-shore account... maybe buy me a new car too!;-)

But seriously... this is really bad, and REALLY stupid. But having no protection for most users risks damaging them in ways worse than a few hours of time to manually fix their issue. And from a corporate perspective, loss of sensitive information is a BIG deal and can cost a LOT more. And that's just talking about data loss. Being part of a botnet to help facilitate financial fraud and other badness... that's also double plus ungood... and irresponsible to not take measures to help keep your computer from playing a part in those crimes.

Anyway... I agree it raises question... but there more downside to malware than just downtime.

My boss, who knows just enough about computers to get himself in trouble, is an idiot.

A few days ago, he called me in to come look at his laptop. He said that his computer was infected and that the virus killed his email. After further inspection, I found out that he pressed "ctrl+alt+del" and brought up the Task Manager. He went through and ended all of the svchost.exe's that he could. When I asked him about it, here was his response:

Speaking of which, did anyone at McAfee even bother to test this dat on a Windows XP machine?

I'm sure they did but the real question is not "did McAfee test it against Windows XP?". It's "did they test it against Windows XP with every single version of svchost.exe that Microsoft have ever released?" - the original version and every updated version in every patch and service pack to date?

What McAfee should have is a better way of quarantining critical system files (replace with known good copies, have a robust patch/repair process for system files, have a more stringent fingerprint detection, etc). Maybe a whitelist of known good md5sums for system files (of course, this would have to be updated with every version of those files ever released in any patch by Microsoft).

Two versions! You think there have only been two versions of svchost.exe on XP and 2003?

Not in all the universe. But I don't care about the universe, I just care about my company.

And in my company, with very few exceptions, all Windows systems get the same patches (that is, all workstations get the same workstation patches, all servers get the same server patches). So yes, at any one time, my Windows group can focus their attention on testing with those two versions of Windows--one XP and one Server.

Svchost has been around forever. It basically encapsulates other applications. Svchost handles many things from DCHP client to Windows Themes. The problem is that McAfee doesn't seem to discriminate between any of them in this case. Which would cripple any XP system today.

Svchost has been around forever. It basically encapsulates other applications. Svchost handles many things from DCHP client to Windows Themes. The problem is that McAfee doesn't seem to...

Encapsulation? No doubt that's a valid comment and one that's just as valid to describe, in a more general sense, how Microsoft designs things. On the other hand, I consider a weasel word that describes something that lacks transparency, isn't understandable, and is unnecessarily complex.

I'm trying to avoid having this happen.
I just called our guy who manages the AV server (among other things) and sent him this. He was skeptical, but wasn't opposed to rolling back the server to using 5957 for now until more builds on this story. My system hasn't updated to 5958 yet, even though the AV server was set to deploy that. Let's hope for the best...

I always get a kick when somebody says something stupid like that. I've recently heard that in a meeting with management: "Yeah, but if Microsoft's solution doesn't work, we can call them for help and they are liable for the problems with their product". As ANYONE that ever called Microsoft knows, they're not helpful at all and if you spent too much time on their support lines they will come off with something like: well, we don't support customizations, we can't fix that, read the support contract. Under c

Me too. I just handle my department, thank the gods. I've got two labs that are native Windows -- one with 7 machines and one 15 machine lab. These are hardware oriented labs that have vendor provided software that won't run under emulation.

The other 4 labs run Ubuntu, with VMWare, non-persistent VMs for any activities that absolutely require Windows.

My Windows only labs are in a constant reboot cycle (well, before I shut them down), the rest don't even realize there's anything going on.:) Since tomorrow is Lab day for those two labs, I'm hoping McAfee gets the problem fixed before then. If not, I'll disable boot scan until they do.

The updated dat is available now, an updated extra.dat was available earlier this morning. I was the one that posted it in the tech support forums. You could have however just disabled access protection and on access scan to keep it from scanning at all. Not a great solution but at least your machine works. If your svchost.exe got nuked, copy it back from the system32\dllcache folder.

From some of the other comments on this story, from sysadmins fixing this, it sounds like it hits near completely- or completely-patched XP machines. That's extremely silly a thing to just 'whoops' on.

Two weeks ago it went and deleted two important for dev c++ and another program at my work. It was insistent they were viruses. I'm not sure how I could have received a virus since I get virtually no attachments and don't email anyone outside of work (ie no "fun" emails), I only visit the BBC, Netbean.org, Eclipse.org and a handful of other reputable sites because I rather goof off by writing my own code than doing nothing and I scan all my downloads before installing them.

Sure maybe I got unlucky for the first time in like 3 years. Maybe someone used my computer while I was on holiday but I suspect not. I suspect it's related to this.

There is no such thing as a reputable site on the internet.
Some sites use ad networks, which have happily served malware.
Other sites are run by clueless admins and left vulnerable to commodity exploits.

Seriously. They consume CPU. They stay resident and consume usable memory. They occasionally crash and/or cause other applications not to work. And, in this situation, they break Windows. I don't use AV and have had pretty much zero issues over the last 6 years of using Windows XP. All you need to do is:

That's not enough any more; even reputable websites can often be easily compromised either through SQL injection, XSS, compromised ad server or some other mechanism and apps like Adobe Reader, Office, Flash, Foxit Reader, Firefox, Java, VLC and more have all experienced serious vulnerabilities in recent months, which have often remained unpatched for long periods of time.

I finally gave in and installed my home-licensed copy of Sophos (provided by my work) because there are too many factors outside of my con

I used to believe something along those lines. Then my PC was infected with a worm when I plugged an mp3 player into the USB port. I'd bought the player new, factory-sealed, so it must have picked it up at the manufacturing plant. I disabled all autorun/autoplay after that, but I'm still wary enough that I run Avast to help avoid another similar situation.

Also, none of the things you mention will detect/remove a rootkit if one does manage to make its way onto your PC. I cleaned one up off of a PC that belongs to my sister a few weeks ago, and that was a headache. I did a scan of the infected drive in an external USB case, and that got nearly all of the infected files taken care of, but because most virus scanners apparently don't scan the MBR of non-boot drives, the rootkit was still waiting there and I had to use the Windows recovery console to write a new MBR.

As far as I can tell, her PC was infected through some variation of the "malicious PDF in a hidden IFRAME which belongs to an online advertisement" scenario, because she was already using Firefox exclusively. So maybe you should at least add "don't install Adobe Reader, or if you do, disable browser integration, update it daily, and set Firefox to download PDFs instead of opening them" and "install and use AdBlock Plus, and possibly NoScript" to your list.

* Run something lightweight like StartupMonitor [mlin.net] to catch programs that try to install things in the various startup locations (useful to control bloatware too)

And something else I've done:

* make a fake, read-only AUTORUN.INF directory on usb flash drives and other portable devices so that when a worm tries to write on there, the filename already exists and it fails. So far I've not seen any worms smart enough to look for pre-existing files and delete them before attempting overwriting, and by making it a directory with that name the deletion process is more complicated.

You forgot a couple things:1) Don't run as an admin account except for admin tasks.2) Keep your Adobe products up to date - including Flash and Reader. Someone else you trust might have been compromised and send you an infected PDF file.3) Allow Windows Update to install MRT and update it every time the monthly definitions update comes out.

Running Windows Update daily won't really help you so much but I agree with the reasons you have for keeping it that way. Microsoft releases most patches on the 2nd Tuesd

Will you come to my workplace and enforce these rules (and the rules that others are responding with)? I see several desktops on my network downloading infected pdfs or trojans according to my SEP console. Thankfully these users aren't administrators, but the exploits are just a privilege escalation away from ownage.

I work at a major chip manufacturing plant. At 4.10 I was conferencing with another fab when all our PCs shutdown. 10 minutes later the place was in chaos. Now don't get me wrong the fab keeps going but my god the cost to the company of this. Say 10 sites world wide with 2-5k employees each the majority of which can't do any meaningful work. McAfee have a lot to answer for.

I think the people who have software that autodeploys updates to 20-50k employees without getting a say in the matter (i.e. testing, change management, etc.) have a lot more to answer for. When the software that supposed to *save* your productivity by preventing viruses ends up doing this to your sites, it's time to just throw it in the bin.

I bet that after seeing what McAfee can do when it screws up, they won't bitch about what ClamAV did [slashdot.org].

(for those who need the summary: ClamAV pulled an update that caused it to shut itself down if it was version 0.94 or older after announcing ~6 months in advance that people needed to update, and kept filling log files with warnings to update. McAfee is breaking a Windows component that causes the entire computer to not function, with a less obvious warning, left for the reader to figure out. The hint is the

Based on what we're seeing and reports from the internet, McAfee 8.0 and 8.5 are unaffected by this problem, while versions 8.7 and 8.9 are. It's also XP specific. Still, that combination has to be a very large number of computers worldwide.

What I want to know is how does something like this happen? You would think McAfee takes their new patch and tests it to make sure that it doesn't cause this type of annoying issue. How does something like this slip through the cracks?

Not only do they have to listen to people bitch (rightfully), but since they're likely running Windows XP + McAfee, they can't use their logging tools (meaning they have to do it by hand and then log later), can't get online updates when solutions are available etc.

Back when I used to run a pirated copy of Windows XP I used to get a particular virus all the time. What it did was mimic SVCHOST and use your computer, presumably as a botnet zombie. In some instances you would get a whole bunch of SVCHOST running. However the trouble was, one of those is a legit Windows service. Kill the right one, and you computer speeds up, kill the wrong one, and your computer grinds to a halt.

It sure sounds like they were trying to target that virus (years too late) and killed the wro

The story just hit ABC News, via the Associated Press: "McAfee Antivirus Program Goes Berserk, Reboots PCs" [go.com] There are stories on the Huffington Post and NextGov. The story just broke into mainstream news in the last hour. It just hit the New York Times.

There's nothing on McAfee's home page about this yet. No items in their "News" or "Threat Center" or "Breaking Advisory" sections. There's supposedly a McAfee Knowledge Base article, "False positive detection of w32/wecorl.a in 5958 DAT" [mcafee.com], but their knowledge base site is overloaded. When it eventually loads, there's a download link to a patch. But there's nothing like an apology. All they say is "Problem:
Blue screen or DCOM error, followed by shutdown messages after updating to the 5958 DAT on April 21, 2010."

McAfee has botched their damage control. They should be out there apologizing. Meanwhile, you can watch McAfee stock drop. [yahoo.com]

I work in the financial industry, and this issue caused significant disruption to trading floors throughout Wall Street. Traders are generally quite upset with McAfee right now, so it makes sense that their stock is dropping:)

I have to wonder what controls the various AV companies have to prevent a malicious signature be inserted - for example, someone deliberately doing something like this (but hitting all versions of Windows).

It's not just McAfee that's had this particular style of false-positive problem - Symantec also falsely identified a legitimate part of the Windows 2003 Server resource kit as malware. Fortunately in Symantec's case the damage was very limited.

Computerworld reports [computerworld.com] that McAfee has reacted to user complaints by shutting down their support forum. [mcafee.com] The forum seems to be back up now.
That was an extremely dumb move to pull after the story was already in the New York Times, Business Week, and on TV.

Many frantic users in the forum. The big losers are the enterprise users who bought into McAfee's premium services, with automatic corporate-wide updating. There's no fully automatic, reliable fix yet for systems already damaged.
In some cases, it's apparently necessary to bring in a new copy of "svchost.exe"; the one in quarantine is bad.

This points up a major risk to US computer infrastructure. Any program with remote update is potentially capable of taking down vast numbers of systems. Ones like McAfee or Windows Update, which deploy updates to all targets simultaneously, can cause widespread damage quickly. Remote updating by vendors may need to be regulated, as a public policy issue.

There is a lot of business software that runs only on windows so the whole "just switch to linux" thing is quite impossible in many cases. Of course the problem here isn't windows, it's McAfee, but don't let that stop you from pretending that linux is superior to windows in every way.

The needs of the business dictates what O/S is used. Sometimes linux is best, sometimes windows is. If I acted like a fanboy and let my personal bias overrun the needs of the company then I wouldn't have a job for very long, an

Most AV companies have a range of products which are frequently entirely unrelated to each other.

Symantec have Norton (terrible), Symantec Enterprise (actually not too bad, although it's being obsoleted in favour of Endpoint Protection) and Symantec Endpoint Protection (which requires a Windows server even though it's a Java application which installs Tomcat and Apache in order to operate).

McAfee have a home product, an enterprise product and a "serviced" product (fairly standard managed AV product only you

Avast (which I use at home) does not have all of these features yet. I can tell you that when dealing with hundreds of machines, having that dashboard for antivirus saves many hours of time. You can run more frequent scans on problem machines, or allow more/less freedom with the click of a button. Many of the products also have URL blocking (by category), email attachment filtering through Exchange plugins, etc. One feature I like about Trend Micro is the "behaviour" plugin, which flags anything out of the ordinary - such as accessing files, programs, or drives that they haven't before.

Corporate networks also typically have edge firewalls that will catch many of the malware infested URLs, email attachments, etc that cause problems. For many businesses 200+ computers, the Windows-installed Anti-virus software is actually the last line of defense. Often times the loss of productivity of a couple viruses getting through isn't worth the extra $$ invested in more products or a "better" product with less management features.

Licencing is also a plus. While Norton, McAfeee and Trend Micro are expensive initially, additional licences for a large number of computers and renewal licences each year actually make it less expensive than others such as Avast and Panda.

We've used Mcafee for years. It can take a brand new quad core computer with 4 gigs of ram and make it operate at half its specs. It's garbage. I've used a few antivirus products over the years and all its enterprise features have never worked properly. It's purely marketing and sending PHB's free swag. There are a lot of anti virus companies with the features you mentioned that do it far better than Mcafee. The only reason they are still in business is because of marketing.

> AV-Comparatives' last testing round ranked Norton as the best product on the market

But do they take into account the false positive track record?

That's a relevant point here. I believe Norton/Symantec have also had similar high-impact false positives.

If Antivirus software "A" detects fewer viruses than Norton but only misses out the rare and old ones (e.g. from the DOS era), has been around for years and had zero high impact false positives, I'd prefer it to Norton even if Norton has the lowest false n

Step 1: Disable McAfee entirely. If you can't because of how affected the computer is, copy the svchost.exe from C:\windows\system32\dllcache up to directly in system32 and then start the DCOM service and others that failed to start because of this. Then disable McAfee entirely.

We have hundreds of systems down. We were looking at Avira in any event as it was lighter, but now we are moving there at warp speed. Mcaffee's quality assurance really screwed up on this. Major problems worldwide.

I think your first mistake was looking at Mcafee. Your second is looking at Avira. The proper solution is to look at Clamwin, as it's free and will enable you to have more flexibility in making it do what you want.

And software packages like WinPooch [sourceforge.net] can, among other stuff, hook the "execute" and "open" OS' functions to scan files before accessing them.

Plug-ins:On the other hand, there are numerous plugins to hook clamwin to, so you can check for virus at their point of arrival.(On the client's side there are Firefox [mozilla.org] and Outlook plugins, on the server's side there are Samba plugins)

but personally I supplement always ClamWin with a 2nd antivirus featuring a on-demand scanner.

Don't be a typical smug IT guy. You really think the average consumer is going to go buy a PC and think, "Hey, let me research this anti-virus thing. I think McAfee might suck."
No. Why would they do that? Isn't that why they are coughing up the big bucks to begin with, so that they don't have to? Weather or not they have valid reason to worry is beside the point.
Don't call them stupid though. I can't stand the stigma attached to IT guys, but alot of the times the stigmas are valid.